- Search Overview
- Search Home Page
- Performing Searches
- Basic Search
- Advanced Search
- Advanced Search Building Blocks
- Running an Advanced Search Query
- Query Syntax
- Query by Subject
- Query by Vendor and Product
- Query by Field and Value
- Query by Context Table
- Query Using Regex
- Free Text Search
- Query Using Advanced Query Language Operators
- Query Using Aggregation Functions
- Query Using Structured Fields
- Dynamic Field Extraction
- Natural Language Search
- Anomaly Search
- Refine a Search
- Context Tables in Search
- Search Best Practices
- Search Results
- Dashboard Visualizations
Field Templates
The search results list (both table and list view) present a default selection of fields per event that is curated based on the event type. Change what fields are made visible by selecting one of the templates listed in the Field Template picklist. Each template provides a different selection that is appropriate for the event type. You can also add your own templates.
When you select a field template to use with a search, this field template is saved as a part of the search and is visible in the saved searches list. The default field template is Auto, and this is automatically selected when you log in. If a saved search used a field template that no longer exists, the search will revert to using the Auto template.
To add a new field template:
Click + Add New Field Template.
In the New Field Template dialog, select whether you would like to start from a blank template, and then add fields to that, or if you want to start from the currently visible fields, then click Next.
In the Configure Template step, enter a name for your template and select the fields to make visible from the Available Fields and Displayed Fields lists.
When your configuration if complete, click Save. The new template will automatically be selected under Field Template.
Note
Field Templates are shared across analysts. New field templates created by an analyst will be visible to all other analysts in the same environment.